A new software tool could help locate individuals suspected of war crimes in Ukraine via posts that they may make to the Telegram social media application.
You may not be familiar with Telegram. Neither is your correspondent who equates the name with a form of retro telecommunications which largely fell into disuse in the 1990s. The growth of the internet was largely responsible for the demise of this form of written communications. Nonetheless, the name is back with a vengeance following the launch of the Telegram Messenger service in August 2013.
Telegram was developed by Nikolai and Pavel Valeryevich Durov, Russian-born computer programmers, mathematicians and entrepreneurs. Telegram provides encrypted instant messaging, much like WhatsApp and Signal. Social networking features are also included in the software application. One of Telegram’s achievements is that it has become the most popular messaging service in Russia. MegaFon is the country’s second largest cellphone operator. In March 2022, the company said that Telegram had surpassed WhatsApp as Russia’s most popular messaging service. This growth could have been artificially created by several factors: Firstly, in October 2022, the Russian government added Meta, owner of Facebook and Instagram, to its list of violent and extremist organisations. In March 2022, Facebook and Instagram were banned by the Russian government over accusations of ‘Russophobia’, according to media reports.
Credit: Yuri Samoilov, via Wikimedia Commons
Given the apparent popularity of Telegram in Russia, manufactured or otherwise, it is no surprise that the messaging service is playing an important role in the ongoing war in Ukraine. A report by Time magazine in March 2022 called Telegram “an instrumental tool for both governments and a hub of information for citizens on both sides.” The report continued that it is not only the Russian military, its government and sympathisers who are using the application – Ukraine’s government and sympathisers are also enthusiastic users.
This is not the first time Telegram has found itself in the middle of a warzone. Social media sites such as Twitter (now X), Facebook and YouTube have come under popular and political pressure to curb extremist content. From 2014, these companies began cracking down on content provided by the Islamic State of Iraq and Syria and its followers. Violent content otherwise destined for these sites has now migrated to Telegram where controls are lax to the point of non-existent. Likewise, crackpot conspiracy theorists have found a haven on Telegram as established social media sites have paid closer attention to their ramblings. Telegram seems to have become something of a digital ‘Wild West’ – a place where anything can be posted, and anything goes.
Like every conflict since the advent of the newspaper in the late 17th Century, the conflict in Ukraine is being fought in the information space as an adjunct to the battlefield. Both Russia and Ukraine fight to dominate the information, and hence the cognitive, space with their narratives. Telegram has also become an intelligence tool. Smartphone footage of Russian Army vehicles moving through the streets of an occupied Ukrainian city will indicate where those vehicles are to anyone familiar with the surroundings. The person posting may even add comments about where the vehicles are, and this may be done in near real-time. To preserve security during the Second World War, the American government warned the US public that ‘loose lips sink ships’. Eight decades later, indiscretions on social media can be just as dangerous. Today, loose tweets flatten streets.
Finding the perpetrators
As the article in Time notes, Russia’s government has been an enthusiastic user of Telegram. The application has become a useful vehicle for propagating Moscow’s disinformation, and sympathetic narratives. Although Telegram banned accounts owned by Russia’s state media, alternative channels have sprung up. These claim to be providing objective, facts-based reporting when in reality they are anything but. As the report continues, ‘The War on Fakes’ Telegram channel regularly churns out Russian dezinformatsiya (disinformation). Telegram has also become a home for far darker materials including footage of potential war crimes. Russian combatants fighting in Ukraine have allegedly uploaded pictures of such atrocities to the platform.
It may be possible to use open-source intelligence techniques to determine where these acts took place and to identify those who may have been responsible. The first challenge is ascertaining when the acts occurred. Determining time and date may be possible from the Telegram post itself, or by correlating when it was reported to have taken place via third parties or via reports from the victim’s associates. Alleged perpetrators may be identified by cross-referencing timelines with information on military units in the area at the time. For example, the Ukraine Conflict Monitor provides an accurate chronicle of Russia’s order-of-battle in Ukraine.
Credit: Government of Ukraine
There is an imperative to determine the identity of the individuals responsible for possible war crimes which can be a laborious, if not impossible task, using open sources. The work of the Bellingcat investigative journalism organisation helped determine those responsible for the loss of Malaysian Airlines Flight MH17, in which 298 passengers and crew were killed on 17 July 2014 when their Boeing 777-200ER airliner was shot down over Ukraine. The aircraft was destroyed by a 9K37M1 Buk-M1 (NATO reporting name: SA-11 Gadfly) medium-range surface-to-air missile system belonging to the Russian Army. On 17 November 2023 Igor Girkin and Sergey Dubinskiy, both officers in Russia’s FSB foreign intelligence service, and Leonid Kharchenko, a Russian separatist, were convicted in absentia of mass murder.
Tracking down individuals like Messrs. Dubinsky, Girkin and Kharchenko takes time and painstaking work. Fortunately researchers at the Centre for Information Resilience (CIR), a human rights non-governmental organisation, have devised a way by which Telegram users can be geolocated. CIR’s approach uses the Python programming language. Python was used to create a dedicated script which can extract the geographical coordinates of the devices participating in a Telegram channel. As well as geolocation details, the script can discern the identity of user, the date the post was made, the content of the message and any media that was posted such as still photos or video. CIR researchers have included step-by-step details on how to use this script with Telegram. Instructions are sufficiently clear so that even a non-specialist or someone with only a basic grasp of computing can follow them. Once all these steps have been followed it is possible to visualise the locations of the Telegram users via Google Earth.
It is therefore now possible to see in an instant where the locations of the devices using Telegram are on any specific day. The benefits of such technology are obvious. Suppose a squad of Russian troops have filmed or photographed themselves performing extrajudicial killings of Ukrainian soldiers or civilians. They may have decided to upload this imagery to Telegram to share and boast with their friends. Perhaps they are sharing the imagery with an extreme right-wing Russian nationalist channel? Using CIR’s Python script it could be possible to determine when and where these photographs or video footage was filmed. It is highly likely that individuals may not be using Telegram under their own names. Instead, they may have adopted a nom de guerre or other nickname. Getting these latter details are vitally important. Even nicknames can help lead investigators to someone’s identity which maybe discernible from other sources online.
The double-edged sword
CIR researchers declined to answer questions directed to them regarding their Telegram research tool. Nonetheless, it is clear this Python-based script has significant utility. As well as aiding war crime investigators it could be useful in helping journalists debunk dubious government claims or propaganda. Nonetheless, a note of caution should be sounded. CIR researchers revealed this tool to the world via a LinkedIn post. The danger is that it could be leveraged for nefarious purposes too. Those with hostile intent could also use these techniques to determine the location and identity of any telegram users, malicious or not. Ukrainians under Russian occupation sharing details of human rights abuses could likewise risk geolocation. Individuals outside Ukraine using Telegram could be at risk should these tools be used nefariously. Like many emerging technologies, its impact can be double-edged.
The ongoing war in Ukraine is arguably the first conflict in which social media and social networks have played such an important role. Their importance highlights the fact that the information space, including the cyber domain, has now become a space for exploitation. Software apps such as Telegram are making their presence felt, but so will the techniques devised by CIR to geolocate users. These kinds of tools could likewise prove particularly important in the aftermath of the conflict, when the reckoning for war crimes begins.
Thomas Withington
